From f381f02c8bc7c7186866880ea82fa298a49875fa Mon Sep 17 00:00:00 2001
From: Jose Enrique Hernandez <josehelps@gmail.com>
Date: Fri, 27 Aug 2021 12:23:56 -0400
Subject: [PATCH 01/22] Update auto-merge.yml

---
 .github/workflows/auto-merge.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index ec89bbd1e5..62afba4eb3 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -1,12 +1,14 @@
 name: auto-merge
 
 on:
-  pull_request:
+  pull_request_target:
 
 jobs:
   auto-merge:
     runs-on: ubuntu-latest
     steps:
+      - uses: actions/checkout@v2
       - uses: ahmadnassri/action-dependabot-auto-merge@v2
         with:
+          target: minor
           github-token: ${{ secrets.AUTOMERGE }}

From 6123e7b0eacf710bc3af6c7352698ea07fd5fdba Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Fri, 27 Aug 2021 09:48:39 -0700
Subject: [PATCH 02/22] duplicate

---
 .../endpoint/create_local_admin_accounts_using_net_exe.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index a14fc89726..a92d2b73cc 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -1,7 +1,7 @@
 name: Create local admin accounts using net exe
 id: b89919ed-fe5f-492c-b139-151bb162040e
-version: 4
-date: '2020-07-21'
+version: 5
+date: '2021-08-27'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:
@@ -11,8 +11,7 @@ description: This search looks for the creation of local administrator accounts
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe
-  OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*/add*
-  OR Processes.process=*user*) by Processes.process Processes.process_name Processes.dest
+  OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*user*) AND Processes.process=*/add* by Processes.process Processes.process_name Processes.dest
   | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   |`create_local_admin_accounts_using_net_exe_filter` '
 how_to_implement: You must be ingesting data that records process activity from your

From 5fdbe3eeedbc98ef66e9c058659577cccd89a6d5 Mon Sep 17 00:00:00 2001
From: zbraiterman <zbraiterman@gmail.com>
Date: Sun, 29 Aug 2021 02:02:45 -0400
Subject: [PATCH 03/22] Enhance specificity of cybersecurity terminology and
 references

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index dcad75faaf..791780d157 100644
--- a/README.md
+++ b/README.md
@@ -22,7 +22,7 @@
 
 Welcome to the Splunk Security Content
 
-This project gives you access to our repository of Analytic Stories, security guides that provide background on TTPs, mapped to the MITRE framework, the Lockheed Martin Kill Chain, and CIS controls. They include Splunk searches, machine-learning algorithms, and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.
+This project gives you access to our repository of Analytic Stories, security guides that provide background on tactics, techniques and procedures (TTPs), mapped to the MITRE ATT&CK Framework, the Lockheed Martin Cyber Kill Chain, and CIS Controls. They include Splunk searches, machine learning algorithms and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats.
 
 # Get Content🛡
 The latest Splunk Security Content can be obtained via:

From 74a25076aa6941c07f4f259236bb6d8def476c2c Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Mon, 30 Aug 2021 11:47:19 -0700
Subject: [PATCH 04/22] Update create_local_admin_accounts_using_net_exe.yml


From 05b10cecabd96e6066894c59b2e96cd82ae4302d Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Mon, 30 Aug 2021 11:47:43 -0700
Subject: [PATCH 05/22] Update create_local_admin_accounts_using_net_exe.yml

---
 .../endpoint/create_local_admin_accounts_using_net_exe.yml      | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index a92d2b73cc..5774e675f3 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -1,7 +1,7 @@
 name: Create local admin accounts using net exe
 id: b89919ed-fe5f-492c-b139-151bb162040e
 version: 5
-date: '2021-08-27'
+date: '2021-08-28'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:

From 621ecc8ab259fc68595457f2439ceb8e9ce1b9b0 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 30 Aug 2021 11:57:40 -0700
Subject: [PATCH 06/22] Testing the syntax for the source branch for a pull
 request.

---
 .github/workflows/detection-testing.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index 241c21d3ec..0a7ff7afc1 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -30,9 +30,8 @@ jobs:
       runs-on: ubuntu-latest
       environment: Detection-Testing-Approval
       needs: [validate-tag-if-present]
-      #Only run when we are pushing to the head of a branch or on a PR.
-      #This implicitly means that we do not run on a tag
-      if: startsWith(github.ref, 'refs/heads/')  || startsWith(github.ref, 'refs/pull/')
+      #Only run when tagged
+      if: startsWith(github.ref, 'refs/heads/')
       steps:  
 
           - name: Checkout Repo
@@ -80,6 +79,11 @@ jobs:
               source venv/bin/activate 
               pip install -q -r requirements.txt
               
+              echo "First give the full ref GITHUB_REF: ${{ GITHUB_REF }}"
+              echo "Pull request's base branch is: ${BASE_BRANCH}"
+              echo "Then give the github.event.pull_request.head.ref: ${{ github.event.pull_request.head.ref }}"
+              
+
               if [[ ! -z "${{ github.event.issue.pull_request }}" &&  ! -z "${{ github.event.issue.number }}" ]]; then
                   python3 main.py -b develop -pr ${{ github.event.issue.number }}
                 

From 196a7a07f922181a185b0a8874f2cd90ffce7fa5 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 30 Aug 2021 12:00:05 -0700
Subject: [PATCH 07/22] Wrong escape sequence for GITHUB_REF

---
 .github/workflows/detection-testing.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index 0a7ff7afc1..c981d38e83 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -79,7 +79,7 @@ jobs:
               source venv/bin/activate 
               pip install -q -r requirements.txt
               
-              echo "First give the full ref GITHUB_REF: ${{ GITHUB_REF }}"
+              echo "First give the full ref GITHUB_REF: ${ GITHUB_REF }"
               echo "Pull request's base branch is: ${BASE_BRANCH}"
               echo "Then give the github.event.pull_request.head.ref: ${{ github.event.pull_request.head.ref }}"
               

From 7500d66b3252bb8f933db4a6ab7857921738eebd Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 30 Aug 2021 12:03:47 -0700
Subject: [PATCH 08/22] Fixing bad github_ref substitution due to spacing.

---
 .github/workflows/detection-testing.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index c981d38e83..b078517546 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -79,7 +79,7 @@ jobs:
               source venv/bin/activate 
               pip install -q -r requirements.txt
               
-              echo "First give the full ref GITHUB_REF: ${ GITHUB_REF }"
+              echo "First give the full ref GITHUB_REF: ${GITHUB_REF}"
               echo "Pull request's base branch is: ${BASE_BRANCH}"
               echo "Then give the github.event.pull_request.head.ref: ${{ github.event.pull_request.head.ref }}"
               

From 3d6b2e074dc7f8f5d4e80f8712ce7a84c06633d3 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 30 Aug 2021 12:08:51 -0700
Subject: [PATCH 09/22] Fixed detection testing to run on PR and push instead
 of just push. We were bailing on PR

---
 .github/workflows/detection-testing.yml | 2 --
 1 file changed, 2 deletions(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index b078517546..da39d3e038 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -30,8 +30,6 @@ jobs:
       runs-on: ubuntu-latest
       environment: Detection-Testing-Approval
       needs: [validate-tag-if-present]
-      #Only run when tagged
-      if: startsWith(github.ref, 'refs/heads/')
       steps:  
 
           - name: Checkout Repo

From c76f9c7c617392daa6a8d770e2f8c29500501ab2 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 30 Aug 2021 13:14:15 -0700
Subject: [PATCH 10/22] Fixed github actions testing behavior for Push vs PR
 for detection testing.  Now checking out of proper source branch and running
 main.py on the proper source brach and PR number.

---
 .github/workflows/detection-testing.yml | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index da39d3e038..eaa30fe0bc 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -34,9 +34,16 @@ jobs:
 
           - name: Checkout Repo
             uses: actions/checkout@v2
-            with:
-              ref: 'develop'
           
+
+          #The following branch name only works (and is only used) for a push
+          #to a branch. We used a different method for getting the source branch
+          #from a PR
+          - name: Get branch and PR required for detection testing main.py
+            id: vars
+            run: |
+              echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
+
           - name: Install System Packages
             run: | 
               sudo apt update -qq
@@ -77,14 +84,10 @@ jobs:
               source venv/bin/activate 
               pip install -q -r requirements.txt
               
-              echo "First give the full ref GITHUB_REF: ${GITHUB_REF}"
-              echo "Pull request's base branch is: ${BASE_BRANCH}"
-              echo "Then give the github.event.pull_request.head.ref: ${{ github.event.pull_request.head.ref }}"
-              
-
               if [[ ! -z "${{ github.event.issue.pull_request }}" &&  ! -z "${{ github.event.issue.number }}" ]]; then
-                  python3 main.py -b develop -pr ${{ github.event.issue.number }}
-                
+                echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
+                python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.issue.number }}
               else
-                  python3 main.py -b develop
+                echo "Push from branch [${{ steps.vars.outputs.branch }}]"
+                python3 main.py -b ${{ steps.vars.outputs.branch }}
               fi

From 851e0bd536630ef5dc7b4b269500098d7f5dca19 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 30 Aug 2021 13:15:28 -0700
Subject: [PATCH 11/22] Removed duplicate id from detection-testing.yml

---
 .github/workflows/detection-testing.yml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index eaa30fe0bc..c4ca7971e5 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -62,10 +62,6 @@ jobs:
               source venv/bin/activate
               python3 -m pip install -q -r requirements.txt
           
-          - name: Get branch and PR required for detection testing main.py
-            id: vars
-            run: |
-              echo ::set-output name=tag::${GITHUB_REF#refs/tags/}
               
           #Set up credentials in the environment so that boto will be able to find them
           - uses: aws-actions/configure-aws-credentials@v1

From 5bb24d5fc9cf78d0bd78405aa12621ee0bf73d86 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 30 Aug 2021 13:22:47 -0700
Subject: [PATCH 12/22] Fixed variable name for pull request number.

---
 .github/workflows/detection-testing.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index c4ca7971e5..b7fc8ae6b8 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -80,9 +80,9 @@ jobs:
               source venv/bin/activate 
               pip install -q -r requirements.txt
               
-              if [[ ! -z "${{ github.event.issue.pull_request }}" &&  ! -z "${{ github.event.issue.number }}" ]]; then
+              if [[ ! -z "${{ github.event.issue.pull_request }}" &&  ! -z "${{ github.event.pull_request.number }}" ]]; then
                 echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
-                python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.issue.number }}
+                python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }}
               else
                 echo "Push from branch [${{ steps.vars.outputs.branch }}]"
                 python3 main.py -b ${{ steps.vars.outputs.branch }}

From 29c6e20ddb7c4493cf6ab224a5ce532e8a1fe82e Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 30 Aug 2021 13:48:04 -0700
Subject: [PATCH 13/22] detection testing

---
 .github/workflows/detection-testing.yml       | 29 ++++++++++---------
 ...ate_local_admin_accounts_using_net_exe.yml |  2 +-
 2 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index 241c21d3ec..e3fdfff1cf 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -30,16 +30,20 @@ jobs:
       runs-on: ubuntu-latest
       environment: Detection-Testing-Approval
       needs: [validate-tag-if-present]
-      #Only run when we are pushing to the head of a branch or on a PR.
-      #This implicitly means that we do not run on a tag
-      if: startsWith(github.ref, 'refs/heads/')  || startsWith(github.ref, 'refs/pull/')
       steps:  
 
           - name: Checkout Repo
             uses: actions/checkout@v2
-            with:
-              ref: 'develop'
           
+
+          #The following branch name only works (and is only used) for a push
+          #to a branch. We used a different method for getting the source branch
+          #from a PR
+          - name: Get branch and PR required for detection testing main.py
+            id: vars
+            run: |
+              echo "::set-output name=branch::${GITHUB_REF#refs/heads/}"
+
           - name: Install System Packages
             run: | 
               sudo apt update -qq
@@ -58,10 +62,6 @@ jobs:
               source venv/bin/activate
               python3 -m pip install -q -r requirements.txt
           
-          - name: Get branch and PR required for detection testing main.py
-            id: vars
-            run: |
-              echo ::set-output name=tag::${GITHUB_REF#refs/tags/}
               
           #Set up credentials in the environment so that boto will be able to find them
           - uses: aws-actions/configure-aws-credentials@v1
@@ -80,9 +80,10 @@ jobs:
               source venv/bin/activate 
               pip install -q -r requirements.txt
               
-              if [[ ! -z "${{ github.event.issue.pull_request }}" &&  ! -z "${{ github.event.issue.number }}" ]]; then
-                  python3 main.py -b develop -pr ${{ github.event.issue.number }}
-                
+              if [[ ! -z "${{ github.event.issue.pull_request }}" &&  ! -z "${{ github.event.pull_request.number }}" ]]; then
+                echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
+                python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }}
               else
-                  python3 main.py -b develop
-              fi
+                echo "Push from branch [${{ steps.vars.outputs.branch }}]"
+                python3 main.py -b ${{ steps.vars.outputs.branch }}
+              fi
\ No newline at end of file
diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index 5774e675f3..4e1f4a476f 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -1,7 +1,7 @@
 name: Create local admin accounts using net exe
 id: b89919ed-fe5f-492c-b139-151bb162040e
 version: 5
-date: '2021-08-28'
+date: '2021-08-29'
 author: Bhavin Patel, Splunk
 type: TTP
 datamodel:

From 8429e518634d80a5dee0ade5a2f229534640eed8 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 30 Aug 2021 14:18:46 -0700
Subject: [PATCH 14/22] Testing what is being passed to detectrion testing.

---
 .github/workflows/detection-testing.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index b7fc8ae6b8..d1bf1291b5 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -82,8 +82,8 @@ jobs:
               
               if [[ ! -z "${{ github.event.issue.pull_request }}" &&  ! -z "${{ github.event.pull_request.number }}" ]]; then
                 echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
-                python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }}
+                #python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }}
               else
                 echo "Push from branch [${{ steps.vars.outputs.branch }}]"
-                python3 main.py -b ${{ steps.vars.outputs.branch }}
+                #python3 main.py -b ${{ steps.vars.outputs.branch }}
               fi

From 9ad3e184e2bbe8a090164c7d8cdb889875090c3e Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 30 Aug 2021 14:24:51 -0700
Subject: [PATCH 15/22] Priting out pr number and ohter variables

---
 .github/workflows/detection-testing.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index d1bf1291b5..5a9e7eaa04 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -80,6 +80,9 @@ jobs:
               source venv/bin/activate 
               pip install -q -r requirements.txt
               
+              echo "github.event.issue.pull_request : [${{ github.event.issue.pull_request }}]"
+              echo "github.event.pull_request.number: [${{ github.event.pull_request.number }}]"
+              echo "steps.vars.outputs.branch       : [${{ steps.vars.outputs.branch }}]"
               if [[ ! -z "${{ github.event.issue.pull_request }}" &&  ! -z "${{ github.event.pull_request.number }}" ]]; then
                 echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
                 #python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }}

From 289360bc8de302ca94e8cd1b871e04dc4ede26ab Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 30 Aug 2021 14:35:20 -0700
Subject: [PATCH 16/22] Print out more env variables associated with pull
 request.

---
 .github/workflows/detection-testing.yml | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index 5a9e7eaa04..f9c704b332 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -80,9 +80,12 @@ jobs:
               source venv/bin/activate 
               pip install -q -r requirements.txt
               
-              echo "github.event.issue.pull_request : [${{ github.event.issue.pull_request }}]"
-              echo "github.event.pull_request.number: [${{ github.event.pull_request.number }}]"
-              echo "steps.vars.outputs.branch       : [${{ steps.vars.outputs.branch }}]"
+              echo "github.event.issue.pull_request    : [${{ github.event.issue.pull_request }}]"
+              echo "github.event.pull_request.number   : [${{ github.event.pull_request.number }}]"
+              echo "steps.vars.outputs.branch          : [${{ steps.vars.outputs.branch }}]"
+              echo "github.event.pull_request.head.ref: [${{ github.event.pull_request.head.ref }}]"
+
+
               if [[ ! -z "${{ github.event.issue.pull_request }}" &&  ! -z "${{ github.event.pull_request.number }}" ]]; then
                 echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
                 #python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }}

From bddb7a7835b9851155baac3ca6887e0b254fd060 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Mon, 30 Aug 2021 14:41:20 -0700
Subject: [PATCH 17/22] Fixed correct branch and PR number for both pushes and
 PRs for detection testing.

---
 .github/workflows/detection-testing.yml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index f9c704b332..4c249d4452 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -85,11 +85,10 @@ jobs:
               echo "steps.vars.outputs.branch          : [${{ steps.vars.outputs.branch }}]"
               echo "github.event.pull_request.head.ref: [${{ github.event.pull_request.head.ref }}]"
 
-
-              if [[ ! -z "${{ github.event.issue.pull_request }}" &&  ! -z "${{ github.event.pull_request.number }}" ]]; then
+              if [[ ! -z "${{  github.event.pull_request.head.ref }}" &&  ! -z "${{ github.event.pull_request.number }}" ]]; then
                 echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
-                #python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }}
+                python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }}
               else
                 echo "Push from branch [${{ steps.vars.outputs.branch }}]"
-                #python3 main.py -b ${{ steps.vars.outputs.branch }}
+                python3 main.py -b ${{ steps.vars.outputs.branch }}
               fi

From 23dd1e6f6445453e22676b0a3f6a42cf0c0b1a6c Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 30 Aug 2021 15:13:16 -0700
Subject: [PATCH 18/22] test

---
 .github/workflows/detection-testing.yml                    | 7 ++++++-
 .../endpoint/create_local_admin_accounts_using_net_exe.yml | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index e3fdfff1cf..ecc55d38ce 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -80,7 +80,12 @@ jobs:
               source venv/bin/activate 
               pip install -q -r requirements.txt
               
-              if [[ ! -z "${{ github.event.issue.pull_request }}" &&  ! -z "${{ github.event.pull_request.number }}" ]]; then
+              echo "github.event.issue.pull_request    : [${{ github.event.issue.pull_request }}]"
+              echo "github.event.pull_request.number   : [${{ github.event.pull_request.number }}]"
+              echo "steps.vars.outputs.branch          : [${{ steps.vars.outputs.branch }}]"
+              echo "github.event.pull_request.head.ref: [${{ github.event.pull_request.head.ref }}]"
+
+              if [[ ! -z "${{  github.event.pull_request.head.ref }}" &&  ! -z "${{ github.event.pull_request.number }}" ]]; then
                 echo "Pull request from source branch [${{ github.event.pull_request.head.ref }}] for PR number [${{ github.event.issue.number }}]"
                 python3 main.py -b ${{ github.event.pull_request.head.ref }} -pr ${{ github.event.pull_request.number }}
               else
diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
index 4e1f4a476f..44d1cf8a46 100644
--- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
+++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml
@@ -7,7 +7,7 @@ type: TTP
 datamodel:
 - Endpoint
 description: This search looks for the creation of local administrator accounts using
-  net.exe.
+  net.exe .
 search: '| tstats `security_content_summariesonly` count values(Processes.user) as
   user values(Processes.parent_process) as parent_process min(_time) as firstTime
   max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=net.exe

From 3d80496f79060be801e1dbb6419d6e883d2879c4 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 31 Aug 2021 10:49:39 -0700
Subject: [PATCH 19/22] if victim then risk

---
 bin/generate.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/bin/generate.py b/bin/generate.py
index 86abe3e838..241fddcb5f 100644
--- a/bin/generate.py
+++ b/bin/generate.py
@@ -361,7 +361,7 @@ def add_rba(detection):
             if entity['type'].lower() in risk_object_user_types:
                 
                 for r in entity['role']:
-                    if 'attacker' == r.lower():
+                    if 'attacker' == r.lower() or 'victim' ==r.lower():
 
                         risk_object['risk_object_type'] = 'user'
                         risk_object['risk_object_field'] = entity['name']
@@ -373,7 +373,7 @@ def add_rba(detection):
             elif entity['type'].lower() in risk_object_system_types:
                 
                 for r in entity['role']:
-                    if 'attacker' == r.lower():
+                    if 'attacker' == r.lower() or 'victim' ==r.lower():
                         
                         risk_object['risk_object_type'] = 'system'
                         risk_object['risk_object_field'] = entity['name']

From d2c2cf38f7dbe95e7ad2583c91f71a8336615c3a Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Tue, 31 Aug 2021 11:06:47 -0700
Subject: [PATCH 20/22] add observable and clean up

---
 detections/endpoint/disable_registry_tool.yml         | 11 ++++++++---
 detections/endpoint/disable_show_hidden_files.yml     | 11 ++++++++---
 detections/endpoint/disable_windows_app_hotkeys.yml   | 11 ++++++++---
 .../endpoint/start_up_during_safe_mode_boot.yml       |  9 +++++++--
 4 files changed, 31 insertions(+), 11 deletions(-)

diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml
index f02aaacce0..b86174c023 100644
--- a/detections/endpoint/disable_registry_tool.yml
+++ b/detections/endpoint/disable_registry_tool.yml
@@ -29,8 +29,8 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
@@ -38,9 +38,14 @@ tags:
   impact: 40
   kill_chain_phases:
   - Exploitation
-  message: Disabled Registry Tools
+  message: Disabled Registry Tools on $dest$
   mitre_attack_id:
   - T1562.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml
index cfb7714f9f..8db415439d 100644
--- a/detections/endpoint/disable_show_hidden_files.yml
+++ b/detections/endpoint/disable_show_hidden_files.yml
@@ -31,8 +31,8 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
@@ -40,10 +40,15 @@ tags:
   impact: 40
   kill_chain_phases:
   - Exploitation
-  message: Disabled 'Show Hidden Files'
+  message: Disabled 'Show Hidden Files' on $dest$
   mitre_attack_id:
   - T1564.001
   - T1562.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml
index 43ddd6ec43..6fee3152df 100644
--- a/detections/endpoint/disable_windows_app_hotkeys.yml
+++ b/detections/endpoint/disable_windows_app_hotkeys.yml
@@ -33,16 +33,21 @@ tags:
   automated_detection_testing: passed
   confidence: 100
   context:
-  - Source: Endpoint
-  - Stage: Defense Evasion
+  - Source:Endpoint
+  - Stage:Defense Evasion
   dataset:
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/hotkey_disabled_hidden_user/windows-sysmon.log
   impact: 40
   kill_chain_phases:
   - Exploitation
-  message: Disabled 'Windows App Hotkeys'
+  message: Disabled 'Windows App Hotkeys' on $dest$
   mitre_attack_id:
   - T1562.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security
diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml
index 2624d8c5e6..7830a68142 100644
--- a/detections/endpoint/start_up_during_safe_mode_boot.yml
+++ b/detections/endpoint/start_up_during_safe_mode_boot.yml
@@ -37,10 +37,15 @@ tags:
   impact: 60
   kill_chain_phases:
   - Exploitation
-  message: Safeboot registry $Registry.registry_path$ was added or modified with a
-    new value $Registry.registry_value_name$
+  message: Safeboot registry $registry_path$ was added or modified with a
+    new value $registry_value_name$ on $dest$
   mitre_attack_id:
   - T1547.001
+  observable:
+  - name: dest
+    type: Endpoint
+    role:
+    - Victim
   product:
   - Splunk Enterprise
   - Splunk Enterprise Security

From f9696a663fca24b584437fc222799a1de2291bb4 Mon Sep 17 00:00:00 2001
From: Bhavin Patel <bhavin.j.patel91@gmail.com>
Date: Tue, 31 Aug 2021 11:20:17 -0700
Subject: [PATCH 21/22] Update auto-merge.yml

---
 .github/workflows/auto-merge.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 62afba4eb3..96c30258b6 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -1,5 +1,4 @@
 name: auto-merge
-
 on:
   pull_request_target:
 

From 3b08a853302fe1bf32e300513bf2f746b647e624 Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Tue, 31 Aug 2021 11:56:18 -0700
Subject: [PATCH 22/22] Fixed testing so that it only runs on Push and
 Create/Reopen PR.

---
 .github/workflows/build-and-validate.yml | 5 ++++-
 .github/workflows/detection-testing.yml  | 5 ++++-
 .github/workflows/semgrep-analysis.yml   | 5 ++++-
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build-and-validate.yml b/.github/workflows/build-and-validate.yml
index 792ea30512..1fb179755b 100644
--- a/.github/workflows/build-and-validate.yml
+++ b/.github/workflows/build-and-validate.yml
@@ -13,7 +13,10 @@
 
 
 name: build-and-validate
-on: [push, pull_request]
+on:
+  push:
+  pull_request:
+    types: [opened, reopened]
 jobs:
   validate-tag-if-present:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/detection-testing.yml b/.github/workflows/detection-testing.yml
index 4c249d4452..475c3b3320 100644
--- a/.github/workflows/detection-testing.yml
+++ b/.github/workflows/detection-testing.yml
@@ -1,5 +1,8 @@
 name: detection-testing
-on: [push, pull_request]
+on:
+  push:
+  pull_request:
+    types: [opened, reopened]
 jobs:
 
   validate-tag-if-present:
diff --git a/.github/workflows/semgrep-analysis.yml b/.github/workflows/semgrep-analysis.yml
index 9c3ea7cee0..dc62c7f86a 100644
--- a/.github/workflows/semgrep-analysis.yml
+++ b/.github/workflows/semgrep-analysis.yml
@@ -5,7 +5,10 @@
 
 name: Semgrep
 
-on: [push, pull_request]
+on:
+  push:
+  pull_request:
+    types: [opened, reopened]
 jobs:
 
   validate-tag-if-present: